Prior to version 3.8.6, the WeGIA web manager exposes an installer endpoint that can be accessed before the configuration file has been established. A crafted POST parameter "usuario" is directly passed to a shell_exec call, providing the attacker ability to execute arbitrary shell commands as the web‑server user. Additionally, the installer writes attacker‑controlled values into the resulting config.php file, enabling persistent PHP code injection, and includes the supplied database name in a CREATE DATABASE statement, yielding SQL injection. The combination of OS command, PHP code, and SQL injection weaknesses (CWE‑78, CWE‑94, CWE‑89) allows an attacker who can send HTTP requests to the pre‑installation endpoint to run arbitrary commands, persist malicious PHP code, and modify or delete application data.

Any installation of WeGIA older than version 3.8.6 running on a Linux environment is affected. The vulnerability is tied to the pre‑installation web/instalador/instalador.php endpoint, which remains reachable before the configuration phase in those versions. The fix is released in version 3.8.6; earlier releases should be identified by the version tag in the source repository.

With a CVSS score of 6.5, the vulnerability is considered moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating that it has not yet been observed in widespread exploitation. The most likely attack vector is a remote attacker with network access to the application, who can directly access the installer endpoint and send crafted POST data. Successful exploitation would run arbitrary shell commands as the web‑server process, write malicious PHP code to the configuration file, and inject arbitrary SQL into the database creation procedure, providing persistent compromise of the application and its data.